AI Frontier · Sep 16, 2026

This issue covers September 9 to 16. Three of today's papers move the attack surface below the model: AiSPY sits in ONNX Runtime's computation graph, GPUBreach in GPU page tables, and the mobile-agent work in the gap between the interface a person sees and the one an agent reads. None of them touch prompts or weights, and two state outright that existing scanning and audit tooling has no rule coverage at that layer.

Research

AiSPY: the Trojan lives in the ML runtime, not in the data or the model

Current practice audits data and model artifacts and relies on file integrity checks, while the execution environment stays implicitly trusted. AiSPY operates inside the computation graph on an observe-and-execute pattern, monitoring transient tensor states. To break confidentiality it identifies all critical training hyperparameters and exfiltrates them through model weights or output logits. To break integrity it acts as a gradient amplifier: on seeing a steganographic trigger, it turns otherwise weak data poisoning from near-zero success into 100%. The authors implement it in the ONNX Runtime training and inference engines. The malware scanners they evaluated do not flag it, because public rule sets have no coverage for ML runtime Trojans, and the poisoned inputs and resulting models pass current inspection tools.

Sources: arXiv

GPUBreach: GPU-side privilege escalation via Rowhammer, chaining through to CPU root

Rowhammer on GPUs had been limited to untargeted bit-flips in victim data such as model weights, degrading accuracy, with none of the privilege escalation CPU exploits achieve. By exploiting GPU page table management to identify when and where new page tables are allocated, the authors let an unprivileged user's CUDA kernel flip bits in page tables resident in GPU memory and reach other processes' or co-tenants' GPU memory. They use the primitive to leak cryptographic keys from cuPQC libraries and to tamper with a model's GPU assembly code, degrading it more stealthily than prior attacks. They then show GPU-side escalation leading to CPU-side escalation, defeating IOMMU protections so that a user-level program with GPU access obtains a root shell and system-wide control — even outside a multi-tenant setting.

Sources: arXiv

Mobile agents: the user and the agent are not looking at the same interface, and it misleads 77.9% of the time

People perceive interfaces through physical displays and the human visual system, subject to occlusion and luminance contrast limits. Agents consume digital screenshots plus accessibility representations that expose non-visual widget metadata. The same UI state can therefore carry materially different information to each. The authors show that a repackaged clone of a legitimate APK can exploit this desynchronization to steer an agent toward attacker-designated actions while staying fully functional and behaviorally identical for human users: the perturbations are embedded before deployment and need no runtime user instructions, no agent detection and no online adaptation. Across five mobile-agent frameworks, three backbone models and 546 tasks, static and dynamic evaluations give average misleading rates of 77.9% and 66.9%. A questionnaire study with 186 participants found the visual perturbations hard to notice. The precondition is that the user installs the repackaged build.

Sources: arXiv

InceptionRAG: fragment the payload until no piece is suspicious, then let the model's own multi-hop reasoning assemble it

Existing RAG poisoning is largely single-point explicit injection, with the malicious payload fully contained in one document, and recent mitigations are built for exactly that shape. InceptionRAG inverts it, splitting the payload into a chain of dormant passages that look harmless when examined separately and pass existing checks — but that, retrieved together, lead the model to self-deduce the target misinformation across multiple hops. For black-box settings the authors add zeroth-order suffix optimization to generate authoritative-sounding suffixes automatically. Across three datasets and three LLMs, attack success exceeds 80% even under rigorous adversarial constraints, and the attack evades defenses established for single-document injection. The paradox the authors name themselves: stronger reasoning makes a model more vulnerable to reasoning-based poisoning. Their proposed defense, HODOR, isolates documents to decouple the logical dependencies between passages.

Sources: arXiv

RuleAutoPilot: deployable Suricata rules straight from malware traffic, with no prior threat intelligence

Existing LLM approaches either depend on curated threat intelligence — which is produced only after the traffic artifacts already exist — or spend heavily on the model without quality control. RuleAutoPilot adds a Benign Traffic Fingerprinting stage that strips known benign background flows before the LLM sees anything, since a capture usually holds a small amount of security-relevant traffic inside a large volume of noise that both degrades reasoning and raises cost. Rules that fail syntax checks, do not trigger on the source traffic, or produce false positives on a benign corpus are repaired automatically from structured feedback. Across 1,296 malware PCAPs, execution-grounded verification raises rule F1 from 0.443 to 0.539. On a stratified 200-PCAP subset the open-weight gpt-oss-120b reaches 0.524 against Claude Code's 0.623 at 52x lower billed-token cost; swapping only the backbone to Claude Opus 5 gives 0.656 against 0.623 at 40x fewer tokens. At equal backbone the scaffold still wins, so the gain is not just the model. The absolute ceiling is still around 0.66, well short of deploy-and-forget.

Sources: arXiv

Universal defenses for tool-integrated agents: 0% attack success in many settings

The authors put direct prompt injection, indirect prompt injection, memory poisoning and backdoor attacks into one framework and offer two tool-level defenses: Attacker Tool Filtering, which uses anomaly detection such as Isolation Forest to identify and remove suspicious tools, and Normal Tool Recalling, a white-box method that restores the agent's original toolset before planning. Chain-of-Thought prompting, self-reflection and task paraphrasing act as prompt-level defenses. Across four open-weight models (Gemma2-9B, Qwen2-7B, LLaMA3-8B, LLaMA3.1-8B) and three proprietary ones (GPT-3.5, GPT-4, GPT-5), attack success rates fall sharply and reach 0% in many settings while task success is preserved or improved. Note what each defense assumes: the first, that the attack surfaces as an anomalous tool; the second, that the original toolset is known.

Sources: arXiv

Lab announcements

Google DeepMind: Gemini 3.8 Live and 3.8 Live Extended Thinking (September 15)

Two live dialogue models — the first built for scale and cost efficiency, the second for high-complexity tasks and multi-step reasoning. By the figures in the post, Extended Thinking takes first place on Artificial Analysis' Speech to Speech Quality Index at 82.6 and scores 97.7% on Big Bench Audio; on agentic task completion it reaches 68.6% on τ-Voice and 35.1% on Sierra's τ-Voice-banking benchmark. 3.8 Live places second in the Speech Agent Arena. Both are available through the Gemini API, Google Workspace, Search and the Gemini app. The 35.1% on the banking benchmark sitting in the same post as the first-place speech quality score is the most informative pairing in the announcement.

Sources: Google DeepMind Blog

Google: an AI & Economy ATLAS update, with a survey of how scientists use AI (September 15)

ATLAS data is now an interactive, open-access dataset, released alongside research from Google, Google DeepMind and MIT FutureTech that analyses 2,600 specialized AI models and surveys more than 600 US and UK scientists. Scientists use AI at a higher rate than most occupations, nearly half of those surveyed use some form of it daily, and they report saving almost seven hours a week — with the post conceding that the saving has not turned into output, because the bottleneck moved downstream and left a backlog of hypotheses. By occupation, arts, design and media work makes up 19% of India's work-related AI usage, 1.6 times the global average, while computer and mathematical occupations account for 30% in the US, double the share elsewhere.

Sources: Google AI Blog